MEDICARE 

PROGRAM 

INTEGRITY

Contractors Reported 

Generating Savings, 

but CMS Could 

Improve Its Oversight

Report to Congressional Requesters

October 2013

GAO-14-111

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-14-111, a report to 

congressional requesters

October 2013

MEDICARE PROGRAM INTEGRITY

Contractors Reported Generating Savings, but CMS 

Could Improve Its Oversight

Why GAO Did This Study

GAO has designated Medicare as a 

high-risk program, in part because its 

size and complexity make it particularly 

vulnerable to fraud. To help detect and 

prevent potential Medicare fraud, 

CMS—the agency within the 

Department of Health and Human 

Services (HHS) that administers the 

Medicare program—contracts with 

ZPICs. These contractors are to 

identify potential fraud, investigate it 

thoroughly and in a timely manner, and 

take swift action, such as working to 

revoke suspect providers’ Medicare 

billing privileges and referring 

potentially fraudulent providers to law 

enforcement.

GAO examined (1) ZPIC contract costs 

and how ZPICs use those funds, 

(2) the results of ZPICs’ work, and 

(3) the results of CMS’s evaluations of 

ZPICs’ performance and aspects of 

CMS’s evaluation practices. To do this, 

GAO examined ZPIC funding, 

contracts, and related documents; data 

on ZPICs’ workloads, investigations, 

and results; and CMS evaluations of 

ZPICs as well as federal standards for 

performance measurement. GAO also 

interviewed CMS and ZPIC officials.

What GAO Recommends

GAO recommends that CMS collect 

and evaluate information on the 

timeliness of ZPICs’ investigative and 

administrative actions, and develop 

ZPIC performance measures that 

explicitly link ZPICs’ work to Medicare 

program integrity performance 

measures and goals. GAO requested 

comments from HHS on the draft 

report, but none were provided.

What GAO Found

The Centers for Medicare and Medicaid Services (CMS) paid its Zone Program 

Integrity Contractors (ZPIC) about $108 million in 2012. ZPICs reported spending 

most of this funding on fraud case development, primarily for investigative staff, 

who in 2012 reported conducting about 3,600 beneficiary interviews, almost 780 

onsite inspections, and reviews of more than 200,000 Medicare claims.

ZPICs reported that their actions resulted in more than $250 million in savings to 

Medicare in calendar year 2012 from actions such as stopping payment on 

suspect claims. ZPICs also reported taking other actions to protect Medicare 

funds, including having more than 130 of their investigations accepted by law 

enforcement for potential prosecution, and working to stop more than 160 

providers from receiving additional Medicare payments in 2012. However, CMS 

lacks information on the timeliness of ZPICs’ actions—such as the time it takes 

between identifying a suspect provider and taking actions to stop that provider 

from receiving potentially fraudulent Medicare payments—and would benefit from 

knowing if ZPICs could save more money by acting more quickly.

Cost-saving Zone Program Integrity Contractor Actions, 2012

Action Number Associated savings

Medicare claims reviewed and denied

prior to payment 176,079 a $99,916,894

Auto-denial edits recommended 7,264 (37,736 in effect) b $95,635,829

Overpayment determinations referred 515 c $56,403,080

Total reported savings from these actions $251,955,803

Source: GAO analysis of CMS Analysis, Reporting, and Tracking System data. 

a

Provider-specific prepayment edits are used to identify claims for medical review and, based on 

those reviews, claims may be denied before they are paid.

b

Auto-denial edits automatically deny payment for noncovered, incorrectly coded, or inappropriately 

billed services without further review, and can prevent payment for all services submitted by 

suspicious providers or certain types of services for beneficiaries identified as part of a fraud scheme.

c

ZPICs generally received good ratings in annual reviews, with five of six eligible 

for incentive awards. CMS follows some best practices for ZPICs’ oversight, but 

the agency does not clearly link ZPIC performance to agency program integrity 

goals. The majority of the measures CMS uses to evaluate ZPICs relate to the 

quality of their work because, according to CMS officials, quality is the most 

important element. However, evaluation of such measures, while a best practice, 

does not connect ZPIC work to agency performance measures. For example, 

CMS aims to increase the percentage of actions taken against certain high risk 

Medicare providers—work central to ZPICs—but does not explicitly link ZPICs’ 

work to the agency’s progress toward that goal, another best practice that would 

allow the agency to better assess the ZPICs’ support of CMS’s fraud prevention 

efforts.

ZPICs refer Medicare claims to the contractors that process them to recover Medicare payments 

received by a provider in excess of amounts due and payable.

View GAO-14-111. For more information, 

contact Kathleen King at (202) 512-7114 or 

kingk@gao.gov. 
Page i GAO-14-111 Zone Program Integrity Contractors

Letter 1 

Background 3

CMS Paid About $108 Million to ZPICs during Calendar Year 2012, 

Primarily for Fee-for-Service Work, which ZPICs Mostly Spent 

on Fraud Case Development 13

ZPICs Reported More than $250 Million in Savings and Other 

Actions, Primarily from Reactive Sources, but CMS Lacks 

Information on Whether More Could Be Saved 14

CMS Generally Gave ZPICs Good Reviews, but Does Not Link ZPIC 

Performance to Agency Program Integrity Measures 20

Conclusions 24

Recommendations 25

Agency Comments 25

Appendix I Scope and Methodology 26

Appendix II ZPIC Activities and Results, 2012 28

Appendix III GAO Contact and Staff Acknowledgements 31

Tables

Table 1: Zone Program Integrity Contractor (ZPIC) Performance 

Timeline 4

Table 2: Administrative Actions that May Result from Zone 

Program Integrity Contractor (ZPIC) Investigations 9

Table 3: Select Zone Program Integrity Contractor (ZPIC) Actions 

and Associated Savings, Calendar Year 2012 16

Table 4: Zone Program Integrity Contractor (ZPIC) Award Fee 

Elements for Quality of Service 21

Table 5: Selected Zone Program Integrity Contractor (ZPIC) 

Activities and Results by Medicare Fee-for-Service 

Provider Type, Calendar Year 2012 28

Contents 
Page ii GAO-14-111 Zone Program Integrity Contractors

Figures

Figure 1: Zone Program Integrity Contractor (ZPIC) Geographic 

Areas 5

Figure 2: Total Award Amounts for the Six Operating Zone 

Program Integrity Contractors (ZPIC), by Area of Work 11

Figure 3: Breakdown of Fee-for-Service Zone Program Integrity 

Contractor (ZPIC) Spending, 2012 14

Figure 4: Source of Zone Program Integrity Contractor (ZPIC) 

Investigations, 2012 19

Abbreviations

ARTS Analysis, Reporting, and Tracking System

CMS Centers for Medicare & Medicaid Services

COR Contracting Officer’s Representative

CPARS Contractor Performance Assessment Report System

CPI Center for Program Integrity

DME durable medical equipment

DOJ Department of Justice

FAR Federal Acquisition Regulation

FID Fraud Investigation Database

FPS Fraud Prevention System

GPRA Government Performance and Results Act

HHS Department of Health and Human Services

HIPAA Health Insurance Portability and Accountability Act of 1996

MAC Medicare Administrative Contractor

Medi-Medi Medicare-Medicaid Data Match Program

MIP Medicare Integrity Program

OAGM Office of Acquisition and Grants Management

OIG Office of Inspector General

PSC Program Safeguard Contractor

ZPIC Zone Program Integrity Contractor

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-14-111 Zone Program Integrity Contractors

441 G St. N.W.

Washington, DC 20548

October 25, 2013

The Honorable Thomas R. Carper

Chairman

The Honorable Tom Coburn, M.D.

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Claire McCaskill

Chairman

Subcommittee on Financial and Contracting Oversight

Committee on Homeland Security and Governmental Affairs

United States Senate

For more than 20 years, GAO has designated Medicare as a high-risk 

program1 due to its size and complexity, as well as its susceptibility to 

fraud.2 There are no reliable estimates of the extent of fraud in the 

Medicare program, but recent convictions for multimillion dollar schemes 

defrauding the program make clear that it continues to be vulnerable to 

fraud. To help detect and prevent fraud in the Medicare program, the 

Centers for Medicare & Medicaid Services (CMS)—the agency within the 

Department of Health and Human Services (HHS) that administers the 

Medicare program—contracts with Zone Program Integrity Contractors 

(ZPIC) in seven specific geographic zones covering the nation.3

 

1

Medicare is the federal program that helps pay for health care services for individuals 

age 65 years and older, certain individuals with disabilities, and those with end-stage renal 

disease. In 1990, we began to report on government operations that we identified as “high 

risk” for serious weaknesses in areas that involve substantial resources and provide 

critical services to the public. See GAO, High-Risk Series: An Update, 

These 

contractors are responsible for identifying potential fraud, investigating it 

thoroughly and in a timely manner, and taking swift action—such as 

GAO-11-278

(Washington, D.C.: Feb. 2011).

2

In fiscal year 2012, Medicare covered more than 50 million individuals at a cost of 

$545 billion. Fraud involves an intentional act or representation to deceive with the 

knowledge that the action or representation could result in gain. For example, fraud may 

involve Medicare providers or suppliers submitting valid-looking claims for services that 

are not provided.

3

These seven zones cover the entire United States, Puerto Rico, American Samoa, 

Guam, and the Northern Mariana Islands.

 
 

Page 2 GAO-14-111 Zone Program Integrity Contractors

working to revoke suspect providers’ Medicare billing privileges or 

referring such providers to law enforcement.

CMS awarded the first ZPIC contracts in 2008, and ZPICs now operate in 

six of the seven zones; however, weaknesses have been identified in 

CMS’s oversight of ZPICs. Based on a review of the first two ZPICs in 

operation, HHS’s Office of Inspector General (OIG) reported that CMS 

lacked complete and timely information on ZPICs’ activities and results,4

You asked us to examine the activities and oversight of ZPICs. This 

report examines (1) ZPIC contract costs and how ZPICs use those funds, 

(2) the results of ZPICs’ work, and (3) the results of CMS’s evaluations of 

ZPICs’ performance and aspects of CMS’s evaluation practices.

which raised concerns about what is known about ZPICs and their effect 

on Medicare fraud.

To determine ZPIC contract costs and how ZPICs use those funds, we 

analyzed ZPICs’ financial data from CMS’s Analysis, Reporting, and 

Tracking System (ARTS), an online system ZPICs use to submit invoices 

and report workload statistics and that CMS uses to track and analyze 

ZPIC workload, performance, and production; and interviewed ZPIC 

officials on how they use their funds. To examine the six ZPICs’ results, 

we analyzed calendar year 2012 data from CMS ARTS and the Fraud 

Investigation Database (FID).5 These included data on the source of 

investigations and the actions taken against suspect providers. We 

interviewed officials from the operational ZPICs and CMS, as well as HHS 

OIG. We reviewed CMS guidance to ZPICs on how they should prioritize 

and conduct investigations. To examine the results of CMS’s evaluations 

of ZPICs’ performance and aspects of CMS’s evaluation practices, we 

reviewed ZPICs’ contracts and associated documents that set out 

performance requirements, the most recently available ZPIC ratings from 

the Contractor Performance Assessment Reporting System (CPARS),6

 

4

HHS OIG, Zone Program Integrity Contractors’ Data Issues Hinder Effective Oversight, 

OEI-03-09-00520 (Washington, D.C.: November 2011).

5

FID contains data related to Medicare fraud and abuse investigations, cases, and 

payment suspensions by ZPICs. See GAO, Medicare Fraud Prevention: CMS Has 

Implemented a Predictive Analytics System, but Needs to Define Measures to Determine 

Its Effectiveness, GAO-13-104 (Washington, D.C.: Oct. 15, 2012). 

6

The CPARS is a web-based application used by the federal government to record certain 

contractor performance evaluations.
 

Page 3 GAO-14-111 Zone Program Integrity Contractors

and data from CMS on ZPICs’ most recent performance evaluations and 

incentive award results. We reviewed internal CMS guidance on how to 

evaluate ZPIC performance and interviewed CMS and ZPIC officials 

about that evaluation process. We also reviewed federal standards and 

best practices for measuring performance. A more detailed discussion of 

our scope and methodology is included in appendix I.

We conducted this performance audit from October 2012 to September

2013 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

To address Medicare’s vulnerability to fraud, the Health Insurance 

Portability and Accountability Act of 1996 (HIPAA) established the 

Medicare Integrity Program (MIP).7 In particular, HIPAA required the 

Secretary of HHS to enter into contracts to promote the integrity of the 

Medicare program. In exercising its authority to identify and combat 

improper payments,8 CMS created 18 Program Safeguard Contractors 

(PSC) to identify and investigate potential fraud in specific parts of 

Medicare, such as Part A, in particular states or regions.9

 

7

Pub. L. No. 104-191, § 202, 110 Stat. 1936, 1996-98 (codified at 42 U.S.C. § 1395ddd). 

Before 1996, Medicare program integrity activities were subsumed under Medicare’s 

general administrative budget and performed, along with general claims processing 

functions, by insurance companies under contract with CMS. For more on MIP, see 

Medicare Integrity Program: CMS Used Increased Funding for New Activities but Could 

Improve Measurement of Program Effectiveness, GAO-11-592 (Washington, D.C.: 

July 29, 2011).

8

An improper payment is any payment that should not have been made or that was made 

in an incorrect amount (including overpayments and underpayments) under statutory, 

contractual, administrative, or other legally applicable requirements.

9

Medicare fee-for-service consists of Medicare Part A, which covers inpatient hospital 

care, skilled nursing facility care, some home health care services, and hospice care; and 

Medicare Part B, which covers physician and outpatient hospital services, diagnostic tests, 

mental health services, outpatient physical and occupational therapy, ambulance services, 

prosthetics, orthotics, and supplies. In addition to fee-for-service, there is also Medicare 

Part C, Medicare Advantage, under which beneficiaries receive benefits through private 

health plans, and Part D, the outpatient prescription drug benefit.

Background 
 

Page 4 GAO-14-111 Zone Program Integrity Contractors

In 2008, as part of the implementation of broader agency contracting 

reform, CMS began replacing PSCs with ZPICs, reducing the total 

number of contractors and giving additional responsibilities to ZPICs to 

investigate potential fraud across the Medicare fee-for-service program. 

In September 2008, CMS awarded the first two ZPIC contracts for 

Zones 4 and 7. As of September 2013, all but one of the ZPICs— 

Zone 6—was in operation. PSCs continue to operate in Zone 6 because 

of protest-related delays with respect to the Zone 6 ZPIC contract. The 

term of each ZPIC contract is generally for a 1-year base period followed 

by 4 option years, enabling CMS to extend each contract through 5 years 

of performance.10

Table 1: Zone Program Integrity Contractor (ZPIC) Performance Timeline

(See table 1 for contract performance timelines and 

fig. 1 for a map of the seven ZPIC zones.)

Zone Contract awarded Contract fully operational Contract end date

1 September 2010 December 2010 January 2016

2 September 2009 February 2011 October 2014

3 April 2011a April 2012 January 2017

4 September 2008 February 2009 October 2013

5 February 2009 December 2009 December 2014

6 b b b

7 November 2008 February 2009 October 2013

Source: GAO analysis of CMS information.

a

The Zone 3 contract was awarded in April 2011, but CMS subsequently modified the contract 

performance periods to account for protest-related delays.

b

Program Safeguard Contractors continue to operate in Zone 6 because of protest-related delays with 

respect to the Zone 6 ZPIC contract.

 

10CMS may renew these contracts beyond the 5 years of performance without 

competition, if certain conditions are met. 42 U.S.C. § 1395ddd(d); 42 C.F.R. § 421.308.
 

Page 5 GAO-14-111 Zone Program Integrity Contractors

Figure 1: Zone Program Integrity Contractor (ZPIC) Geographic Areas

Note: Program Safeguard Contractors continue to operate in Zone 6 because of protest-related 

delays with respect to the Zone 6 ZPIC contract.
 

Page 6 GAO-14-111 Zone Program Integrity Contractors

In 2010, CMS established the Center for Program Integrity (CPI), which 

oversees the agency’s program integrity efforts, including ZPICs. CPI’s 

stated mission is to ensure that correct payments are made to legitimate 

providers for covered, appropriate, and reasonable services for eligible 

beneficiaries. CPI has undertaken an effort to try to move beyond the 

“pay and chase” approach—which focused on the recovery of funds lost 

due to payments of fraudulent claims—to focusing on fraud prevention. 

To enhance these efforts, the Small Business Jobs Act of 2010 

appropriated funds for and required CMS to implement predictive 

analytics technologies, which are automated systems and tools that can 

help identify patterns of potentially fraudulent claims before they are 

paid.11 In turn, CMS developed the Fraud Prevention System (FPS), an 

electronic system in which Medicare claims data are compared against 

models of potentially fraudulent behavior to identify and prioritize for 

investigation providers with aberrant billing patterns.12 As part of 

implementing FPS, CPI modified ZPICs’ work. They are to continue to 

investigate and quickly initiate actions to protect Medicare, but are also 

charged with investigating certain referrals from FPS.13

To detect and investigate potential fraud within each zone, ZPICs develop 

leads, investigate them, and initiate appropriate actions against suspect 

providers, suppliers, and others. ZPICs do this with teams of 

investigators, data analysts, and medical reviewers. Investigators perform 

a range of actions to examine potential fraud, including conducting 

provider audits, making site visits to suspect providers’ offices, and 

interviewing Medicare beneficiaries. Data analysts, including statisticians, 

examine Medicare claims and other data to support investigations and 

search for potential fraud and new schemes. Medical reviewers, primarily 

nurses, provide clinical knowledge to support the work of investigators 

and data analysts.

 

11Pub. L. No. 111-240, § 4241, 124 Stat. 2504, 2599-2604 (2010).

12For more information on FPS, see GAO-13-104. 

13Referrals from FPS are called Alert Summary Records.

Investigating and Acting on 

Potential Fraud
 

Page 7 GAO-14-111 Zone Program Integrity Contractors

ZPICs identify potential targets for fraud investigations using three 

categories of sources:

1. Reactive sources. Reactive sources are notifications of potential fraud 

submitted to ZPICs, which may result in a ZPIC conducting an 

investigation. A number of entities refer potential fraud to ZPICs for 

investigation. These entities include Medicare Administrative 

Contractors (MAC), which examine their contacts with beneficiaries 

for indications of potential fraud and may forward the contacts to 

ZPICs for additional scrutiny.14

2. Proactive sources. ZPICs are required to maintain at least 3 years of 

Medicare claims data for analysts to examine for potential fraud using 

a variety of analytic tools and methods. For example, analysts 

examining these data may identify providers that, compared with their 

peers, have aberrant billing patterns, which can indicate potentially 

fraudulent behavior. If analysts identify such patterns, those findings 

may result in a ZPIC investigation.

In addition, HHS OIG operates a fraud 

hotline and may refer calls from it to the MACs for initial screening and 

then to the ZPICs for further investigation. Other sources include

investigations ZPICs receive directly from CMS.

3. FPS. FPS identifies providers for ZPICs to investigate, with the goal of 

identifying aberrant billing patterns early so that ZPICs can investigate 

suspect providers before they generate large amounts of potentially 

fraudulent claims.

ZPICs prioritize their investigations according to CMS guidance, which 

states that ZPICs should give priority to investigations with the greatest 

program impact and/or urgency. CMS’s Program Integrity Manual defines 

such investigations as those involving patient abuse or harm, multistate 

fraud, high dollar amounts of potential overpayments, likely increase in 

the amount of fraud or enlarged pattern of fraud, and complaints made by 

Medicare supplemental insurers.15

 

14MACs process and pay Medicare fee-for-service claims and take various other actions 

to implement and enforce Medicare coverage rules.

In addition, with the implementation of 

FPS in July 2011, CMS directed the ZPICs to investigate certain high-risk 

leads from that system.

15Medicare supplemental insurers are private companies that offer insurance policies, also 

known as Medigap, that can help pay for health care costs not covered by Medicare feefor-service, such as co-insurance for doctor office visits.
 

Page 8 GAO-14-111 Zone Program Integrity Contractors

As part of their investigations, ZPICs initiate administrative actions 

against Medicare providers or suppliers, coordinating with CMS and 

MACs to carry out those actions, which may result in Medicare savings. 

(See table 2 for the administrative actions ZPICs may initiate as part of 

their investigations.) For example, ZPICs may initiate payment 

suspensions that allow CMS to stop payment on suspect claims and 

prevent the payment of future claims until an investigation is resolved.16 In 

addition, a ZPIC may recommend to CMS that the agency revoke a 

provider’s Medicare billing privileges and will coordinate with a MAC to 

implement that action following CMS approval. In addition to 

administrative actions, ZPICs may forward vulnerabilities17 identified 

during an investigation to CMS for consideration as possible local or 

national prepayment edits.18

 

16This money will either be returned to Medicare if the review of the claims determines 

they should not be paid, or released to the provider if the review determines the claims 

were legitimate. Although CMS had the authority to impose payment suspensions prior to 

the Patient Protection and Affordable Care Act, the law specifically authorized the 

Secretary of HHS to suspend payments to providers pending the investigation of credible 

allegations of fraud. In implementing this authority, CMS is required to consult with HHS 

OIG in determining whether a credible allegation of fraud exists. Pub. L. No. 111-148, 

§ 6402(h), 124 Stat. 119, 760 (codified at 42 U.S.C. § 1395y(o)).

17Vulnerabilities are billing practices or patterns that are or may be associated with 

significant amounts of improper payments. For more on vulnerabilities, see GAO, 

Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings 

and Better Ensure Proper Payment, GAO-13-102 (Washington, D.C.: Nov. 13, 2012).

18Edits are instructions that MACs program into claims processing systems to identify and 

potentially deny claims that do not meet Medicare coverage or payment criteria. For this 

report, we do not consider such systemwide prepayment edits to be administrative actions 

since they are not specific to a particular investigation or provider. For more on 

prepayment edits, see GAO-13-102. 
 

Page 9 GAO-14-111 Zone Program Integrity Contractors

Table 2: Administrative Actions that May Result from Zone Program Integrity Contractor (ZPIC) Investigations

Action Definition

Implementation of provider-specific 

prepayment review editsa ZPICs request provider-specific prepayment edits to identify claims for medical review 

prior to payment.

Implementation of auto-denial editsa ZPICs request prepayment edits to automatically deny payment for noncovered, 

incorrectly coded, or inappropriately billed services without further review.b

Payment suspension ZPICs request whole or partial suspension of a provider’s Medicare payments.

Overpayment determination ZPICs request recovery of Medicare payments received by a provider in excess of 

amounts due and payable.

Revocation, deactivation, or both ZPICs request revocation of a provider’s Medicare billing privileges; deactivation of a 

provider’s National Provider Identifier, stopping other billing privileges; or a combination 

of both.c

Source: GAO analysis of agency information.

a

In cases of suspected fraud, ZPICs may recommend the implementation of prepayment edits that 

apply to specific providers and automatically deny claims or flag claims for prepayment review. In 

these cases, prepayment edits are considered by CMS to be administrative actions.

b

These edits analyze claims’ attributes and automatically prevent Medicare from paying claims based 

on suspicious attributes. For example, some edits prevent payment for all services submitted by 

suspicious providers. Other edits prevent payment for certain types of services for beneficiaries 

identified as part of a fraud scheme for specific services.

c

Given ZPICs’ role in identifying and investigating potential fraud, for this report we consider 

deactivations initiated by ZPICs to be administrative actions; however, according to CMS officials, the 

agency may deactivate providers’ National Provider Identifiers for a number of reasons, some of 

which may not be a result of an investigation into potential fraud, such as when a provider or supplier 

is no longer submitting claims to Medicare or did not report certain changes to their enrollment 

application or respond to a revalidation request. A provider or supplier whose enrollment has been 

deactivated may have billing privileges restored by resubmitting an enrollment application with 

updated information to CMS.

In addition to administrative actions, if a ZPIC investigation uncovers 

suspected instances of fraud, the ZPIC must refer the investigation to 

HHS OIG for further examination and, if HHS OIG declines to investigate, 

the ZPIC may refer the issue to the FBI or any other interested law 

enforcement entity, such as a U.S. Attorney’s Office. A ZPIC investigation 

that is referred to and accepted by law enforcement for further exploration 

and potential prosecution is then called a case. As long as law 

enforcement entities have not closed a case, it is considered open by 

both law enforcement and ZPICs.

CMS also requires ZPICs to support HHS OIG, the Department of Justice 

(DOJ), and other law enforcement entities with their Medicare fraud 

investigations. This support can be for these entities’ own, independently 

initiated cases, or for those that ZPICs initiated and then referred to law 

enforcement. ZPICs provide support on ZPIC-initiated and non-ZPICinitiated cases by responding to law enforcement requests for information. 

These requests may be for data analysis; provider enrollment records, 
 

Page 10 GAO-14-111 Zone Program Integrity Contractors

which ZPICs obtain from MACs; medical review; or other investigative 

support.

ZPIC contracts cover three areas of work:

1. Fee-for-service program integrity work. ZPICs are to identify and 

investigate potential fraud in Medicare fee-for-service. The contracts 

for this work outline four categories of investigations: Part A, Part B, 

durable medical equipment (DME), and home health and hospice. 

Although DME providers and home health and hospice suppliers 

provide services covered under Medicare Parts A and B, the ZPIC 

contracts identify them separately and ZPICs track their fee-forservice program integrity work based on these four categories.19

2. Medicare-Medicaid Data Match Program (Medi-Medi). Medi-Medi is a 

joint effort between CMS and states to identify providers with aberrant 

Medicare and Medicaid20 billing patterns through analyses of claims 

for individuals with both Medicare and Medicaid coverage. States 

participate voluntarily and ZPIC Medi-Medi work and funding is 

dependent on the number of states, if any, actively participating in 

each zone.21

3. Special projects. CMS may also fund ZPICs for special zone- or fraudspecific projects. Special projects can vary in duration and can be as 

short as several months or run for multiple years.

The total award amount for the six operating ZPIC contracts through all 

option years is more than $600 million. Of that amount, $411 million is for 

fee-for-service program integrity work, $169 million is for Medi-Medi, and 

$62 million is for special zone- and fraud-specific projects over the life of 

the contracts. (See fig. 2.) The contract award amounts for the 

six operating ZPIC contracts (inclusive of option years) range from 

$67 million to $182 million, which reflects variations between the zones in 

 

19CMS has identified newly enrolling DME suppliers and home health agencies as at 

higher risk for fraud than other types of providers.

20Medicaid is a joint federal-state health care program for certain low-income individuals.

21In 2012, 19 states were actively participating in Medi-Medi. These were Alabama, 

Arizona, Arkansas, California, Colorado, Florida, Georgia, Iowa, Mississippi, Missouri, 

Nebraska, New Jersey, New York, North Carolina, Ohio, Oklahoma, Pennsylvania, Texas, 

and Utah. In April 2013, CMS also received a letter of intent to participate from Michigan.

ZPIC Contracts by Area of 

Work and Award Amount
 

Page 11 GAO-14-111 Zone Program Integrity Contractors

terms of their size, exposure to fraud risk, and receipt of special projects. 

For example, Zone 7 covers a geographically small area comprising one 

state and one territory, but is an area CMS considers to be at high risk for 

fraud. In comparison, Zone 2 is a geographically large but predominantly 

rural area comprising 14 states and including areas that may be at a 

lower risk of fraud.22

Figure 2: Total Award Amounts for the Six Operating Zone Program Integrity 

Contractors (ZPIC), by Area of Work

In addition, although not all ZPICs currently receive 

funding for a special project, all six operating ZPICs have at some time 

received such funding. For example, one ZPIC was awarded almost $50 

million for an ongoing state-specific fraud hotline and another received 

almost $3 million for a completed project specifically examining potential 

fraud among home health providers.

Notes: Excludes Zone 6. Program Safeguard Contractors continue to operate in this zone because of 

protest-related delays with respect to the Zone 6 ZPIC contract. CMS awarded the first ZPIC contract 

in September 2008 and the most recent in April 2011. If operating ZPICs are extended for their full 

contract terms, this round of contracts will end between October 2013 and January 2017.

 

22The number of beneficiaries in any one zone ranges from more than 7 million to more 

than 19 million, and the number of providers in any one zone ranges from 130,000 to 

460,000.
 

Page 12 GAO-14-111 Zone Program Integrity Contractors

Medicare fee-for-service consists of Medicare Part A, which covers inpatient hospital care, skilled 

nursing facility care, some home health care services, and hospice care; and Medicare Part B, which 

covers physician and outpatient hospital services, diagnostic tests, mental health services, outpatient 

physical and occupational therapy, ambulance services, prosthetics, orthotics, and supplies.

Medi-Medi is a program that matches data from Medicare and Medicaid—Medicaid is a joint federalstate health care program for certain low-income individuals—to identify patterns of fraud that 

examine data from both programs that only one program may not find.

Special projects are zone- or fraud-specific projects that vary in length and can be as short as a few 

months or can run indefinitely.

CMS primarily oversees ZPICs through the coordinated efforts of CPI and 

the Office of Acquisition and Grants Management (OAGM). The ZPIC 

Contracting Officer in OAGM is responsible for ensuring effective 

contracting, and the Contracting Officer’s Representatives (COR) are in 

CPI. Each ZPIC is assigned a different COR, who helps oversee ZPIC 

contractor compliance through ongoing reviews. Among other things, the 

CORs use CMS ARTS to review their ZPICs’ monthly invoices and 

aggregate workload, such as the total number of new investigations, 

administrative actions, and dollar amounts recouped in a month.

Each ZPIC contract includes award fee provisions, which give contractors 

the opportunity to earn all or some of the award fee allowed under their 

contracts, depending on their level of performance. CMS evaluates each 

ZPIC’s performance annually and determines how much of its award fees 

it will receive. CMS first evaluates whether a ZPIC is eligible for an award 

fee.23 For these reviews, CMS instructs its CORs on how to assess 

specific areas of their ZPICs’ performance by interviewing ZPIC and other 

staff; reviewing a sample of open and closed investigations and cases, as 

well as other documents; reviewing data in CMS ARTS, FID, and other 

systems; and making observations during ZPIC site visits. If in this review 

CMS finds that a ZPIC meets certain performance thresholds,24

 

23CMS tracks the results of these reviews in CPARS, a web-based application used by the 

federal government to record certain contractor evaluations. ZPIC CPARS evaluations 

consist of six elements: (1) quality of service, (2) schedule (meeting deadlines for 

responding to certain requests and submitting certain materials), (3) cost control, 

(4) business relations, (5) management of key personnel, and (6) utilization of small 

business. CPARS scores are based on a five-point scale: (1) unsatisfactory, (2) marginal, 

(3) satisfactory, (4) very good, and (5) exceptional.

the CORs 

move to the second step: using their annual review findings to 

24A ZPIC is eligible to earn award fees if it receives scores of satisfactory or higher in four 

of the six CPARS elements: (1) quality of service, (2) schedule, (3) cost control, and 

(4) business relations.

CMS Oversight and 

Performance Evaluations 

of ZPICs
 

Page 13 GAO-14-111 Zone Program Integrity Contractors

recommend the amount of award fees a ZPIC should receive. The ZPICs’ 

contracts specify through Award Fee Plans the criteria against which 

CMS will measure ZPICs’ performance to earn their fees. These criteria 

fall into two overarching areas: (1) quality of service measures that apply 

to all ZPICs, worth 60 percent of the award fee, and (2) ZPIC-specific 

plans drafted in the prior year by each ZPIC and approved by CMS on 

how the ZPIC will improve its administrative actions—Award Fee 

Administrative Action Plans—worth 40 percent. ZPICs can receive all or 

part of their proposed award fees based on how well they perform in each 

of the elements within the two areas.

CMS paid the six operating ZPICs about $108 million in calendar year 

2012, including about $1.3 million in award fees for each ZPIC’s most 

recent contract year evaluation. CMS’s payments were primarily to 

reimburse contractors for fee-for-service work, comprising $77 million of 

the $108 million paid.

ZPICs reported spending most of their fee-for-service funding in 2012 on 

fraud case development, primarily for investigative staff. (See fig. 3 for the 

breakdown of ZPIC fee-for-service spending.) According to CMS officials, 

fraud case development costs are those related to identifying and 

investigating potential Medicare fraud. These costs include those

associated with developing proactive sources, and addressing potential 

fraud identified by FPS. Personnel accounts for most of these costs, with 

ZPICs reporting that half their fraud case development staff are 

investigators and the other half are split between medical reviewers and 

data analysts. ZPIC officials told us that identifying and investigating 

potential Medicare fraud can be labor intensive, which is why the largest 

direct cost was for personnel. In 2012, ZPICs reported that their 

investigations included 3,600 beneficiary interviews, 777 onsite 

inspections, prepayment reviews of 190,000 suspended claims and 

postpayment reviews of 32,000 paid claims. Additionally, ZPICs added 

more than 1,100 providers to prepayment review and almost 300 

providers to postpayment review.

CMS Paid About 

$108 Million to ZPICs 

during Calendar Year 

2012, Primarily for 

Fee-for-Service Work, 

which ZPICs Mostly 

Spent on Fraud Case 

Development 
 

Page 14 GAO-14-111 Zone Program Integrity Contractors

Figure 3: Breakdown of Fee-for-Service Zone Program Integrity Contractor (ZPIC) 

Spending, 2012

Note: The spending categories in the figure are general spending categories CMS sets for ZPICs.

a

Quality assurance/improvement costs are those related to ZPICs’ activities that ensure that their 

work is being performed consistently and accurately.

In calendar year 2012, ZPICs reported more than $250 million in savings 

to Medicare by stopping payment on suspect claims and recouping 

money from overpayments. However, it is unclear if ZPICs could save 

more money by taking swifter actions since CMS lacks information on the 

speed of those actions. ZPICs took these actions based primarily on 

reactive sources, such as tips and complaints.

ZPICs Reported More 

than $250 Million in 

Savings and Other 

Actions, Primarily 

from Reactive 

Sources, but CMS 

Lacks Information on 

Whether More Could 

Be Saved
 

Page 15 GAO-14-111 Zone Program Integrity Contractors

ZPICs reported initiating administrative actions that led to more than 

$250 million in savings or money recovered to Medicare in calendar year 

2012 (see table 3). These savings represent nearly $100 million in claims 

flagged for review and then denied before payment; almost $100 million 

in auto-denial edits for suspect providers, suppliers, and beneficiaries; 

and almost $60 million recouped by MACs at the request of ZPICs. In 

addition, ZPICs placed more than $14 million in suspense accounts while 

the claims for that money were reviewed.25 ZPICs also reported taking 

actions that could result in savings that may not be easily quantifiable. For 

example, in 2012 ZPICs reported implementing more than 160

revocations and deactivations. Although these actions represent no direct 

savings,26 CMS has reported that revocations are the most effective fraud 

prevention tool because they prevent providers from submitting additional 

potentially fraudulent claims. (See app. II for more information on ZPICs’ 

actions, including by provider type.)

 

25In 2012, ZPICs released about $5 million to providers based on claims reviews.

26The CMS FPS First Year Implementation Report estimated that revocations based on 

FPS investigations saved the Medicare program over $7 million. CMS based this on a 

“conservative” projection of those providers’ existing billing patterns or behaviors; 

however, the HHS OIG evaluation of this report could not confirm the findings. See HHS 

OIG, The Department of Health and Human Services Has Implemented Predictive 

Analytics Technologies but Can Improve Its Reporting on Related Savings and Return on 

Investment, A-17-12-53000 (Washington, D.C.: September 2012).

ZPICs Reported More than 

$250 Million in Savings 

through Administrative 

Actions, but CMS Lacks 

Information to Track the 

Timeliness of These 

Actions 

Example of investigations resulting in a 

revocation:

One ZPIC described that investigations 

involving “false fronts”—meaning there is no 

provider at the designated address—allow the 

ZPIC to quickly initiate revocations of those 

providers’ billing privileges.
 

Page 16 GAO-14-111 Zone Program Integrity Contractors

Table 3: Select Zone Program Integrity Contractor (ZPIC) Actions and Associated Savings, Calendar Year 2012

Action Number Savings associated with action

Claims denied prior to paymenta 176,079 $99,916,894

Auto-denial edits recommendedb 7,264 (37,736 in effect) $95,635,829

Overpayment determinations referred for collectionc 515 $56,403,080 collected

($231,551,875 referred)d

Total reported savings from these administrative actions $251,955,803

Providers under payment suspensione 403 $14,082,755

($5,351,135 released)

Revocations and deactivationsf 164 (102 revocations / 62 deactivations) – 

Source: GAO analysis of CMS Analysis, Reporting, and Tracking System data.

Notes: Table shows the total of selected actions and savings reported by all operating ZPICs in 2012. 

Because Zone 3 was fully operational in April 2012, the totals reflect that zone’s work from April 2012 

through December 2012.

All amounts reflect the Medicare allowed rate for claims, but do not take into account beneficiary 

copayments, other insurance, or other costs.

a

Provider-specific prepayment edits are used to identify claims for medical review and, based on 

those reviews, claims may be denied before they are paid.

b

These edits analyze claims’ attributes and automatically prevent Medicare from paying claims based 

on suspicious attributes. In addition, some edits prevent payment for all services submitted by 

suspicious providers or for certain types of services for beneficiaries identified as part of a fraud 

scheme for specific services.

c

Actions are taken to recover Medicare payments received by a provider in excess of amounts due 

and payable.

d

These amounts reflect all ZPIC overpayment determinations, whether resulting from a ZPIC 

investigation or a law enforcement case.

e

Medicare payments to a provider are suspended, in whole or in part. We did not include the dollar 

amount for suspensions in the estimate of total savings from administrative actions because these 

dollars have not been collected and returned to Medicare.

f

A provider’s Medicare billing privileges are revoked and/or a provider’s National Provider Identifier is 

deactivated, stopping other billing privileges.
 

Page 17 GAO-14-111 Zone Program Integrity Contractors

ZPICs coordinate with law enforcement entities on ZPIC-initiated and 

other investigations, resulting in additional savings to Medicare and other 

results. In 2012, ZPICs reported that law enforcement entities accepted 

more than 130 new cases from them, with HHS OIG as the primary entity 

accepting the cases, followed by the FBI.27 In addition, ZPICs reported 

completing almost 1,800 requests for information for cases initiated by 

law enforcement and almost 700 for cases that had been initiated by 

ZPICs, primarily for data analysis. ZPICs also reported that, as a result of 

their cases being accepted and prosecuted by law enforcement, 

convicted providers were ordered to pay almost $80 million28 in courtdetermined fines, settlements, and/or restitutions.29 Cases can also result 

in prison sentences and other actions,30

According to CMS, ZPICs are to take immediate action to protect 

Medicare funds, but CMS may be missing opportunities for additional 

savings to Medicare because the agency lacks information on the 

timeliness of certain ZPIC actions. ZPIC officials reported taking actions 

though CMS does not 

consistently track those outcomes. ZPICs are to track information on the 

results of their cases in FID, but the system contains few outcomes. CMS 

officials said that they are aware of this issue and have taken steps to 

both improve ZPICs’ use of FID and integrate the system with CMS ARTS 

and other systems to improve the data in FID. As of August 2013, CMS 

officials reported that the agency was testing the integration of the 

systems and expected the integration to be completed by late 2013.

 

27In 2012, law enforcement declined to accept as cases 33 investigations referred by 

ZPICs due to lack of resources. No investigations were reportedly declined for any other 

reason, such as the quality of the ZPIC referral.

28This is the amount reported to ZPICs by HHS OIG or DOJ for what convicted providers 

were ordered to pay in 2012. Providers may have been referred to law enforcement prior 

to 2012 and actual amounts collected may be less due to appeals and collection issues, 

such as suspect providers that close their businesses or declare bankruptcy.

29We previously reported that in fiscal year 2011, the federal government won or 

negotiated approximately $2.4 billion in judgments and settlements related to health care 

fraud, including Medicare fraud. See GAO, Health Care Fraud: Types of Providers 

Involved in Medicare, Medicaid, and the Children’s Health Insurance Program Cases, 

GAO-12-820 (Washington, D.C.: Sept. 7, 2012).

30Depending on the nature of the misconduct, HHS OIG may be authorized or required to 

exclude individuals and entities from federally funded health care programs. See 

42 U.S.C. §§ 1320a-7, 1320c-5. HHS OIG maintains the List of Excluded Individuals and 

Entities. See http://oig.hhs.gov/exclusions/ (accessed July 18, 2013). In 2012, ZPICs did 

not refer any providers to HHS OIG for exclusion.

Example of an investigation resulting in a 

law enforcement referral: 

One ZPIC recently identified chiropractors 

opening pain management clinics and billing 

Medicare for diabetic neuropathy treatments, 

such as physical therapy and pneumatic 

devices. However, on inspection, these 

providers were using nonclinical massage 

chairs, such as those often found in nail 

salons. The ZPIC identified 17 such clinics, all 

operated by the same provider, which were 

successfully referred to law enforcement for 

further investigation and possible prosecution.
 

Page 18 GAO-14-111 Zone Program Integrity Contractors

and preventing potentially fraudulent payments before they were made, in 

line with CMS fraud strategies, and CMS ARTS data show ZPICs 

implementing some aspects of these strategies. For example, ZPIC 

officials reported focusing on prepayment reviews of claims—preventing 

potentially fraudulent payments—and 2012 CMS ARTS data showed that, 

of the providers whom ZPICs reviewed in 2012, almost five times as 

many had their claims reviewed on a prepayment basis rather than a 

postpayment basis. However, CMS does not track information on the 

swiftness of these actions, such as the length of time between a ZPIC’s 

receipt of a complaint about a suspect provider and the ZPIC’s visit to that 

provider, or between identifying a potentially fraudulent provider and 

initiating an administrative action. Federal internal control standards state 

that agencies’ management should have information on performance 

relative to established objectives so that actual performance can be 

continually compared against goals and differences can be analyzed.31

Because CMS does not have information on ZPICs’ timeliness for these 

types of activities, the agency cannot benchmark any changes in 

timeliness or measure the effectiveness of its strategies, such as whether 

ZPICs are limiting unnecessary losses to Medicare from suspect 

providers continuing to receive potentially fraudulent Medicare payments 

while awaiting investigative or administrative actions.

Reactive sources—primarily complaints—were the major source of new 

ZPIC investigations in 2012, accounting for almost 90 percent of the 

almost 5,000 new investigations that year. (See fig. 4 for the sources of 

ZPIC investigations.) In 2012, ZPICs received almost 5,000 complaints, 

45 percent of which were from MACs and over 50 percent from other 

sources, primarily the HHS OIG hotline, as reported by ZPIC officials. 

Proactive projects and FPS each accounted for less than 10 percent of 

investigations. Examples of proactive projects include analyzing data to 

identify spikes—large, rapid increases—in providers’ billing patterns; 

aberrant providers, such as those with unusual billing patterns; and 

schemes related to stolen beneficiary identities. ZPIC officials reported 

that their proactive data analysis projects are valuable because they find 

zone-specific fraud or new fraud schemes that reactive sources or FPS 

may not identify. For example, one ZPIC that covers multiple frontier 

 

31See GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00.21.3.1 (Washington, D.C.: Nov. 1, 1999).

ZPICs Identified Potential 

Fraud Primarily through 

Reactive Sources

Example of proactive data analysis:

Analysis of one rural state’s Medicare data 

identified a minor billing anomaly that 

ultimately led to a fraud scheme involving a 

provider directing beneficiaries to use a 

colander-like hat to self-administer electroshock therapy.
 

Page 19 GAO-14-111 Zone Program Integrity Contractors

states conducted a proactive project related to critical access hospitals, 

40 percent of which are in that ZPIC’s geographic zone.32

Figure 4: Source of Zone Program Integrity Contractor (ZPIC) Investigations, 2012

ZPIC officials 

reported that as a result of this project, they identified overpayments to 

several hospitals that had opened new psychiatric units, as well as 

opportunities for education to improve patient care. (See app. II for more 

information on the sources of ZPIC investigations.)

a

Proactive sources are those identified by ZPIC data analysis. ZPICs are to maintain at least 3 years 

of Medicare claims data for analysts to examine for potential fraud using a variety of analytic tools 

and methods. If analysts identify patterns in the claims data indicating potential fraud, those findings 

may result in a ZPIC investigation.

b

Reactive sources are notifications of potential fraud submitted to ZPICs. A number of entities refer 

potential fraud to ZPICs for investigation. These entities include Medicare Administrative Contractors’ 

Complaint Units, which examine their contacts with beneficiaries for indications of potential fraud and 

 

32Critical access hospitals are small rural hospitals that receive payment for their 

reasonable costs of providing inpatient and outpatient services to Medicare beneficiaries, 

rather than being paid fixed amounts under Medicare’s prospective payment systems. See 

GAO Medicare: Modest Eligibility Expansion for Critical Access Hospital Program Should 

Be Considered, GAO-03-948 (Washington, D.C.: Sept. 19, 2003).
 

Page 20 GAO-14-111 Zone Program Integrity Contractors

may forward the contacts to ZPICs for additional scrutiny. ZPICs also receive notifications of potential 

fraud directly from CMS and from other ZPICs, such as those involved with special projects.

c

The Fraud Prevention System (FPS) is an electronic system in which Medicare claims data are 

compared against models of potentially fraudulent behavior to identify and prioritize for ZPIC 

investigation certain providers with aberrant billing patterns.

Although ZPIC officials previously reported issues with the quality of leads 

from FPS, as well as a decline in the number of proactive projects as a 

result of increased work to address FPS leads, officials have since 

reported improvements in FPS and their ability to address leads from the 

system.33 For example, officials from one ZPIC reported that the leads 

from FPS have improved and that the zone developed a new process for 

investigating those leads, thereby improving results. CPI officials reported 

that they will continue to direct ZPICs to investigate leads from proactive 

and reactive sources, as well as FPS, noting that the most successful

ZPICs are those that can effectively address leads from all three 

categories.

Based on CMS’s annual reviews, five of the six operating ZPICs were 

eligible for some portion of their contracts’ available award fees, and 

ZPICs received almost 70 percent of all fees for their most recent periods 

of performance.34

 

33

The five ZPICs’ ratings for the elements considered in 

the annual reviews—elements that measure aspects of quality of service, 

cost control, business relations, and timeliness of certain activities—

ranged from satisfactory to exceptional, meeting the award fee eligibility 

requirement of at least a satisfactory rating in all four of these elements. 

CMS awarded the five eligible ZPICs about two-thirds of the available 

award fees—$1.3 million out of $1.9 million—in the ZPICs’ most recent 

contract years based on ZPIC performance both on quality-of-service 

measures in the annual reviews and achievement of their Award Fee 

Administrative Action Plan goals. CMS officials reported that they 

assigned the majority of available award fee amounts—60 percent—to 

the quality-of-service measures in the annual evaluations because quality 

is the most important element of ZPICs’ work. CMS apportions the 

60 percent of award fee amounts for quality of service across multiple 

GAO-13-104. 

34CMS evaluates ZPICs at the end of each of their contract years, so each ZPIC is 

reviewed on a different schedule. These results are from the most recent available 

evaluations for periods of performance ending from March 2010 through April 2012.

CMS Generally Gave 

ZPICs Good Reviews, 

but Does Not Link 

ZPIC Performance to 

Agency Program 

Integrity Measures
 

Page 21 GAO-14-111 Zone Program Integrity Contractors

assessment criteria. Table 4 lists the quality-of-service measures for 

which ZPICs could earn award fees. Among the highest-value elements 

are how well ZPICs prioritize and document investigations, conduct 

medical reviews, and analyze data. ZPICs’ Award Fee Administrative 

Action Plan goals varied by ZPIC, and included goals such as developing 

a project to identify and prevent phantom provider schemes and 

improving the timeliness of initiating and implementing payment 

suspensions. CMS officials said that this portion of the award fee is 

intended to encourage ZPICs to develop more innovative ways to take 

administrative actions.

Table 4: Zone Program Integrity Contractor (ZPIC) Award Fee Elements for Quality of Service

Performance categories Assessment criteria Percentage of score

Investigations Prioritization of investigations 12

Investigation files 12

Cases Law enforcement referrals 10

Administrative actions 12

Fraud Investigation Database (FID) Inputting data into FID 6 

Medical review Medical review 12

Security Handling and physical security of sensitive material 6 

ZPIC facility security 6 

Claims data Claims data and IT 6 

Data analysis Data analysis 12

Deliverables Contractually required deliverables 6 

Total 100

Source: GAO analysis of CMS information.

Note: Quality-of-service award fee elements account for 60 percent of ZPICs’ proposed award fees. 

The other 40 percent is based on ZPICs’ performance reaching their annual Award Fee 

Administrative Action Plan goals.

CMS follows some best practices for its oversight of ZPICs, but does not 

clearly link ZPIC performance to agency performance measures and 

goals. The award fee evaluations allow CMS to assess key elements of 

ZPICs’ work, which follows federal best practices. Federal standards state 

that performance measures may address the type or level of program 

activities conducted (process), the direct products and services delivered 

by a program (outputs), or the results of those products and services 
 

Page 22 GAO-14-111 Zone Program Integrity Contractors

(outcomes).

35 CMS’s measures evaluate ZPICs’ processes and outputs, 

but not their outcomes. Moreover, these performance measures do not 

connect ZPIC work to agency performance measures that are linked to its 

goals, which is another best practice. One way that agencies examine the 

effectiveness of their programs is by measuring performance as required 

by the Government Performance and Results Act of 1993 (GPRA), as 

amended by the GPRA Modernization Act of 2010.36 One of CMS’s 

GPRA goals is to fight fraud and work to eliminate improper payments.37

Within that goal are two Medicare fee-for-service performance measures 

for determining progress toward that goal, and CMS officials reported that 

ZPICs are the primary actors for one of the measures: increasing the 

percentage of providers who are identified as high risk against whom

CMS takes administrative actions.38

 

35Performance measurement is the ongoing monitoring and reporting of program 

accomplishments, particularly progress toward pre-established goals, and focuses on 

whether a program has achieved its objectives, expressed as measurable performance 

standards. See GAO, Performance Measurement and Evaluation: Definitions and 

Relationships (Supersedes 

CMS’s fiscal year 2014 target for this 

performance measure is to increase the percentage of administrative 

actions taken for these high-risk providers from 27 percent to 36 percent. 

Federal standards state that entities should link performance 

measurements to goals and objectives, and previous GAO work found 

that leading organizations try to link the goals and performance measures 

for each organizational level to successive levels and ultimately to the 

GAO-05-739SP), GAO-11-646SP (Washington, D.C.: May 2,

2011), GPRA, and GAO, Managing for Results: Critical Actions for Measuring 

Performance, GAO/T-GGD/AIMD-95-187 (Jun. 20, 1995). 

36GPRA is designed to improve the effectiveness of federal programs by establishing a 

system to set goals for program performance and to measure results. Pub. L. No. 103-62, 

107 Stat. 285 (1993), as amended by Pub. L. No. 111-352, 124 Stat. 3866 (2011).

37This goal also includes fighting fraud and working to eliminate improper payments in 

other HHS programs not administered by CMS, such as foster care. See HHS, FY 2014 

HHS Online Performance Appendix, 

http://www.cms.gov/About-CMS/Agency-Information/PerformanceBudget/index.html?redir

ect=/ performancebudget/ (accessed July 8, 2014).

38The other Medicare fee-for-service performance measure for this goal is to reduce the 

percentage of improper payments—which include potentially fraudulent payments—made 

under the Medicare fee-for-service program. CMS’s current estimate of the percentage of 

improper payments is 8.5, and the agency’s performance measure is to reduce that to 8.0 

in fiscal year 2014. In total, CMS has seven performance measures within the goal of 

fighting fraud and working to eliminate improper payments, four of which relate to 

Medicare. See the HHS FY 2014 HHS Online Performance Appendix.
 

Page 23 GAO-14-111 Zone Program Integrity Contractors

organization’s strategic goals.39

While creating outcome measures for ZPICs may be challenging, CMS 

could develop measures that better link ZPICs’ work to agency 

performance measures and goals. GAO has previously reported several 

factors that make assessing the outcomes of health care fraud prevention 

work—such as that conducted by ZPICs—difficult.

However, according to CMS officials, 

none of the ZPICs’ performance measures link to the agency’s measures 

of increasing the percentage of administrative actions taken against highrisk providers, or to the other Medicare fee-for-service program integrity 

performance measure of reducing improper payments. Some ZPICs had 

goals in their Award Fee Administrative Action Plans related to the 

agency’s performance measures—for example, one ZPIC set a goal of 

increasing the value of its referrals of overpayments, which could reduce 

improper payments—but these were zone-specific and do not allow CMS 

to evaluate the overall impact of ZPICs on agency measures and, 

ultimately, goals. CMS officials told us in April 2013 that they are revising 

the ZPIC Award Fee Plans, but based on a draft of the revisions and 

discussions with CMS officials, the revised plans will continue to lack 

measures related to outcomes and will not tie performance to agency 

program integrity measures or goals.

40 These include the 

difficulties of establishing a health care fraud baseline to determine 

whether the amount of fraud has changed over time, quantifying the effect 

of the work on deterring fraud, and establishing a causal link between the 

work and changes in health care fraud. In addition, CMS officials as well 

as other stakeholders cautioned against setting targets, such as the 

number of law enforcement referrals or revocations, as performance 

measures or goals since that could create incentives for ZPICs to refer 

more cases to law enforcement or revoke more providers’ billing 

privileges than investigations may merit, potentially jeopardizing the 

quality of ZPICs’ work.41

 

39

Although developing outcome measures can be 

GAO/AIMD-00-21.3.1 and GAO, Executive Guide: Effectively Implementing the 

Government Performance and Results Act, GAO/GGD-96-118 (Washington, D.C.: June 1, 

1996).

40GAO, Health Care Fraud and Abuse Control Program: Indicators Provide Information on 

Program Accomplishments, but Assessing Program Effectiveness Is Difficult, GAO-13-746

(Washington, D.C.: Sept. 30, 2013).

41See CMS agency comments in HHS OIG, Medicare’s Program Safeguard Contractors: 

Performance Evaluation Reports, OEI-03-04-00050 (Washington, D.C.: March 2006).
 

Page 24 GAO-14-111 Zone Program Integrity Contractors

difficult and setting targets can be problematic, CMS could explicitly link 

ZPICs’ work to the agency’s progress toward meeting its performance 

measures and goals. Specifically, CMS officials reported that they are 

using FPS to identify and track high-risk providers for the performance 

measure of increasing the number of administrative actions taken against 

those providers. Although ZPICs are the primary users of FPS and have 

primary responsibility for initiating administrative actions, CMS does not 

link ZPICs’ use of FPS to that measure, hindering the agency’s ability to 

effectively oversee its progress toward meeting its goal of fighting fraud 

and working to eliminate improper payments.42

Given the vulnerability of the Medicare program to fraud and the lack of 

reliable estimates of the extent of fraud in the program, determining how 

well CMS is carrying out its fraud prevention strategy is a vital, if 

challenging, task. ZPICs, which are central to that strategy, reported that 

their efforts have yielded positive results, such as savings greater than 

their contract costs and multiple other actions that helped protect 

Medicare from potentially fraudulent providers, such as referring suspect 

providers to law enforcement. Yet little is known about how expeditiously 

ZPICs take action to save Medicare funds—an important consideration 

given that the longer a fraud scheme operates, the greater the potential 

financial losses. As a result, CMS would benefit from enhancing its 

collection and evaluation of information on the timeliness of ZPICs’ 

actions, including information on whether new tools or strategies have 

increased the speed with which ZPICs investigate potentially fraudulent 

providers or initiate administrative actions. In addition, as CMS attempts 

to achieve its agencywide program integrity goal of fighting fraud and 

eliminating improper payments in the Medicare program, it would benefit 

from knowing how ZPICs are contributing to efforts to achieve this goal. 

By linking the evaluation of ZPICs’ work to the agency’s program integrity 

performance measures—in particular the performance measure focused 

on administrative actions, which are a significant portion of ZPICs’ work—

CMS would have greater assurance that its ZPIC activities are 

appropriately supporting CMS fraud prevention efforts.

 

42In November 2011, HHS OIG recommended that CMS utilize and report ZPIC workload 

statistics from ARTS in ZPIC evaluations. See OEI-03-09-00520.

Conclusions 
 

Page 25 GAO-14-111 Zone Program Integrity Contractors

To help ensure that CMS’s fraud prevention activities are effective and 

that CMS is comprehensively assessing ZPIC performance, the 

Administrator of CMS should take the following two actions:

Collect and evaluate information on the timeliness of ZPICs’ 

investigative and administrative actions, such as how soon 

investigations are initiated after ZPICs identify potential fraud and how 

swiftly ZPICs initiate administrative actions after identifying potentially 

fraudulent providers.

Develop ZPIC performance measures that explicitly link their work to 

the agency’s Medicare fee-for-service program integrity performance 

measures and targets for its GPRA goal of fighting fraud and working 

to eliminate improper payments.

We requested comments from HHS, but none were provided.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Health 

and Human Services, the Acting Administrator of CMS, appropriate 

congressional committees, and other interested parties. In addition, the 

report will be available at no charge on the GAO website at 

http://www.gao.gov. 

If you or your staff have any questions about this report, please contact 

me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix III.

Kathleen King

Director, Health Care

Recommendations 

Agency Comments
Appendix I: Scope and Methodology

Page 26 GAO-14-111 Zone Program Integrity Contractors

To determine Zone Program Integrity Contractors’ (ZPIC) contract costs 

and how ZPICs use those funds, we examined data from CMS’s Analysis, 

Reporting, and Tracking System (ARTS), an online system ZPICs use to 

submit invoices and report workload statistics and which CMS uses to 

track and analyze ZPIC workload, performance, and production. 

Specifically, we examined aggregated ZPIC invoices and workload 

statistics that specified how ZPICs allocate their funds, and interviewed 

ZPIC officials to confirm these data. We also reviewed the task orders 

outlining the scope of each zone’s work and obtained data from CMS on 

ZPIC contract amounts.

To describe the results of ZPIC Medicare fee-for-service investigations, 

we examined data from CMS ARTS and the Fraud Investigation 

Database (FID), a secure system that contains details related to Medicare 

fraud and abuse investigations. We analyzed calendar year 2012 data for 

the six operating ZPICs on the sources of their investigations, the 

numbers of administrative actions taken, and dollar values of relevant 

actions. We reviewed CMS guidance on how ZPICs should prioritize their 

work and how to conduct investigations. We interviewed officials from the 

CMS Center for Program Integrity about how they review and track ZPIC 

administrative actions and their process of approval for actions, such as 

revocations. We interviewed officials from all six ZPICs to learn about 

their internal guidance on prioritizing and conducting their work, how they 

determine when to take administrative actions, and how they decide to 

refer a case to law enforcement.

To examine the results of CMS’s evaluation of ZPICs’ performance and 

aspects of CMS’s evaluation practices, we reviewed the following: each 

ZPIC’s most recent Contractor Performance Assessment Report; each 

ZPIC’s most recently completed Award Fee Administrative Action Plan, 

which describes the ZPIC’s plans to improve administrative actions and 

how it will earn its award fee; and data from CMS on the percentage and 

amount of each zone’s award fee. We reviewed internal CMS guidance 

on how to evaluate ZPICs’ performance, as well as federal standards and 

best practices for measuring performance. We also interviewed CMS 

contracting and other officials to learn about the review process and how 

such guidance is applied, and to discuss changes to ZPIC evaluations 

and performance measures. We also interviewed ZPIC officials to learn 

more about how ZPICs determine their Award Fee Administrative Action 

Plan goals and how they evaluate themselves on these goals and other 

work.

Appendix I: Scope and Methodology
Appendix I: Scope and Methodology

Page 27 GAO-14-111 Zone Program Integrity Contractors

We assessed the reliability of the data we obtained from CMS ARTS and 

FID through interviews with agency officials and users, system 

demonstrations, and, in the case of CMS ARTS, direct use of the system. 

We shared with CMS and the relevant ZPIC any errors we identified 

through reviews of the data and comparisons with other sources to obtain 

corrected information. We found the data sufficiently reliable for the 

purposes of this review.

We conducted this performance audit from October 2012 to September

2013 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.
Appendix II: ZPIC Activities and Results, 2012

Page 28 GAO-14-111 Zone Program Integrity Contractors

The following table shows selected ZPIC activities and results reported by 

ZPICs in CMS ARTS. Durable medical equipment (DME) is covered 

under Medicare Part B, and home health and hospice under are covered 

under Part A, but ZPICs report data in CMS ARTS as monthly aggregates 

by Part A, Part B, DME, and home health and hospice. CMS ARTS data 

do not allow us to identify particular provider types, such as whether a 

Part B provider was a family physician or podiatrist.

Table 5: Selected Zone Program Integrity Contractor (ZPIC) Activities and Results by Medicare Fee-for-Service Provider Type, 

Calendar Year 2012

Data element Part Aa Part Bb

Durable 

medical 

equipment

Home health 

and hospice Total

Investigations

Number of investigations closed 660 1,741 1,901 557 4,859

Number of new investigations 

from reactive sourcesc Medical review 5 26 7 21 59

MAC complaint unitd 248 972 669 298 2,187

CMS field offices 14 30 12 22 78

Other ZPIC contracts 59 19 10 2 90

Other 284 801 1,010 380 2,475

Number of new investigations 

from proactive sourcese 65 100 166 53 384

Number of new investigations 

from FPSf – – – – 257

Number of new proactive 

projects 26 83 67 10 186

Casesg

Number of cases accepted by 

law enforcement 21 72 29 17 139

Number of potential cases 

declined by law enforcement

For reasons within the 

control of the ZPICh 0 0 0 0 0 

For reasons outside 

the control of the ZPIC 6 17 6 4 33

Total dollars of courtdetermined fines, settlements, 

and/or restitutions $8,652,710 $28,938,678 $7,666,681 $33,768,044 $79,026,113

Number of cases closed 53 152 64 22 291

Appendix II: ZPIC Activities and Results, 

2012
Appendix II: ZPIC Activities and Results, 2012

Page 29 GAO-14-111 Zone Program Integrity Contractors

Data element Part Aa Part Bb

Durable 

medical 

equipment

Home health 

and hospice Total

Administrative actionsi

Dollar amount referred for 

overpayment collection $34,095,059 $40,724,933 $68,620,097 $88,111,786 $231,551,875

Amounts recovered on 

overpaymentsj $7,200,445 $22,473,168 $13,470,567 $13,258,900 $56,403,080

Number of providers added to 

prepayment medical reviewk 52 492 493 104 1,141

Dollar amount of prepayment 

claims denied $24,194,983 $35,223,594 $33,183,318 $7,314,999 $99,916,894

Number of providers added to 

postpayment medical reviewl 43 98 74 38 253

Number of new auto-deny edits 

recommended for 

implementationm 229 2,985 3,916 134 7,264

Dollar amount of ZPICrecommended auto-denials $336,161 $33,713,756 $53,578,849 $8,007,063 $95,635,829

Number of revocations 

requestedn 8 175 33 10 226

Number of revocations 

implemented 5 77 16 4 102

Number of deactivations 

requestedo 3 69 4 3 79

Number of deactivations 

implemented 2 60 0 0 62

Workload

Number of beneficiary 

interviews 82 1,468 653 1,455 3,658

Number of onsites performed 84 441 126 126 777

Number of claims reviewed 

prior to payment 5,497 110,831 65,462 8,334 190,124

Number of claims reviewed 

after payment 5,831 9,067 5,414 12,390 32,702

Requests for informationp

Number of requests received 

from law enforcement for ZPICinitiated cases 127 362 149 81 683

Number of requests received 

from law enforcement for nonZPIC initiated cases 339 935 221 267 1,762

Source: GAO analysis of CMS Analysis, Reporting, and Tracking System data.

Notes: Medicare fee-for-service consists of Medicare Part A, which covers inpatient hospital care, 

skilled nursing facility care, some home health care services, and hospice care; and Medicare Part B, 

which covers physician and outpatient hospital services, diagnostic tests, mental health services, 
Appendix II: ZPIC Activities and Results, 2012

Page 30 GAO-14-111 Zone Program Integrity Contractors

outpatient physical and occupational therapy, ambulance services, prosthetics, orthotics, and 

supplies. In addition to fee-for-service, there is also Medicare Part C, Medicare Advantage, under 

which beneficiaries receive benefits through private health plans, and Part D, the outpatient 

prescription drug benefit.

a

Medicare Part A providers are those providing inpatient hospital care, skilled nursing facility care, 

some home health care services, and hospice care.

b

Medicare Part B providers are those providing physician and outpatient hospital services, diagnostic 

tests, mental health services, outpatient physical and occupational therapy, ambulance services, 

prosthetics, orthotics, and supplies.

c

Reactive sources are notifications of potential fraud submitted to ZPICs.

d

Medicare Administrative Contractors (MAC) process and pay Medicare fee-for-service claims and 

take various other actions to implement and enforce Medicare coverage rules. MAC Complaint Units 

examine their contacts with beneficiaries for indications of potential fraud and may forward the 

contacts to ZPICs for additional scrutiny.

e

Proactive sources are those identified by ZPICS that originate from such sources as data analysis, 

the Internet, and news media. ZPICs are to maintain at least 3 years of Medicare claims data for 

analysts to examine for potential fraud using a variety of analytic tools and methods. If analysts 

identify patterns in the claims data indicating potential fraud, those findings may result in a ZPIC 

investigation.

f

The Fraud Prevention System (FPS) is an electronic system in which Medicare claims data are 

compared against models of potentially fraudulent behavior to identify and prioritize for ZPIC 

investigation certain providers with aberrant billing patterns. Although ZPICs report other sources of 

investigations by the provider type targeted—Part A, Part B, durable medical equipment, and home 

health and hospice—ZPICs only report the total number of investigations resulting from FPS.

g

A ZPIC investigation that is accepted by law enforcement for further exploration and potential 

prosecution is then referred to as a case.

h

Reasons within the control of the ZPIC are primarily related to the quality of the referral.

i

ZPICs initiate administrative and other actions against Medicare providers or suppliers, coordinating 

with CMS and MACs to carry out those actions.

j

This amount reflects all amounts recovered, whether resulting from a ZPIC investigation or a law 

enforcement case. Some overpayment amounts are offset—applied to future payments—rather than 

collected.

k

ZPICs request provider-specific prepayment edits to identify claims for medical review prior to 

payment and, on the basis of those reviews, claims may be denied before they are paid.

l

ZPICs request provider records for medical review after the claims have been paid and, based on 

those reviews, claims may be referred to MACs to recover Medicare payments received by a provider 

in excess of amounts due and payable.

mZPICs request prepayment edits to automatically deny payment for non-covered, incorrectly coded, 

or inappropriately billed services without further review. These edits analyze claims’ attributes and 

automatically prevent Medicare from paying claims based on suspicious attributes. For example, 

some edits prevent payment for all services submitted by suspicious providers. Other edits prevent 

payment for certain types of services for beneficiaries identified as part of a fraud scheme for specific 

services.

n

ZPICs request revocation of a provider’s Medicare billing privileges.

o

ZPICs request deactivation of a provider’s National Provider Identifier, stopping other billing 

privileges. Given ZPICs’ role in identifying and investigating potential fraud, we consider deactivations 

initiated by ZPICs to be administrative actions; however, according to CMS officials, the agency may 

deactivate providers’ National Provider Identifiers for a number of reasons, some of which may not be 

as a result of an investigation into potential fraud, such as when a provider or supplier is no longer 

submitting claims to Medicare or did not report certain changes to their enrollment application or 

respond to a revalidation request. A provider or supplier whose enrollment has been deactivated may 

have their billing privileges restored by resubmitting an enrollment application with updated 

information to CMS.

p

ZPICs report requests for information from the Department of Health and Human Services’ Office of 

Inspector General and the Department of Justice. 
Appendix III: GAO Contact and Staff 

Acknowledgements

Page 31 GAO-14-111 Zone Program Integrity Contractors

Kathleen M. King, (202) 512-7114 or kingk@gao.gov

In addition to the contact named above, Karen Doran, Assistant Director; 

Matthew Gever; Elizabeth Morrison; Eden Savino; Kristin Van Wychen; 

and Jennifer Whitworth made key contributions to this report.

Appendix III: GAO Contact and Staff 

Acknowledgements 

GAO Contact

Staff 

Acknowledgements 

(291070)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.